You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -47,7 +28,7 @@ Azure Active Directory ([Azure AD](https://azure.microsoft.com/en-us/services/ac
47
28
48
29
You need to create a number of secrets before you can install an ODM instance with an external OIDC provider such as the Azure AD service, and use web application single sign-on (SSO). The following diagram shows the ODM services with an external OIDC provider after a successful installation.
49
30
50
-
31
+
51
32
52
33
The following procedure describes how to manually configure ODM with an Azure AD service.
53
34
@@ -65,15 +46,15 @@ Terminology:
65
46
66
47
The Authorization Code flow is best used by server-side apps in which the source code is not publicly exposed. The apps must be server-side because the request that exchanges the authorization code for a token requires a client secret, which has to be stored in your client. However, the server-side app requires an end user because it relies on interactions with the end user's web browser which redirects the user and then receives the authorization code.
The Client Credentials flow is intended for server-side (AKA "confidential") client applications with no end user, which normally describes machine-to-machine communication. The application must be server-side because it must be trusted with the client secret, and since the credentials are hard-coded, it cannot be used by an actual end user. It involves a single, authenticated request to the token endpoint which returns an access token.
The Microsoft identity platform supports the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant, which allows an application to sign in the user by directly handling their password. Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows cannot be used.
@@ -113,11 +94,11 @@ After activating your account by email, you should have access to your Aure AD i
113
94
* Membership type: Assigned
114
95
* Click **Create**
115
96
116
-
97
+
117
98
118
99
In **Azure Active Directory** / **Groups** take note of the Object ID. It will be referenced as ``GROUP_ID`` later in this tutorial.
119
100
120
-
101
+
121
102
122
103
2. Create at least one user that belongs to this new group.
123
104
@@ -135,8 +116,8 @@ After activating your account by email, you should have access to your Aure AD i
135
116
136
117
* Click **Review + create** and then **Create**.
137
118
138
-
139
-
119
+
120
+
140
121
141
122
* Click the **myodmuser** user previously created
142
123
* Edit properties
@@ -157,7 +138,7 @@ After activating your account by email, you should have access to your Aure AD i
157
138
* Supported account types / Who can use this application or access this API?: select `Accounts in this organizational directory only (Default Directory only - Single tenant)`
158
139
* Click **Register**
159
140
160
-
141
+
161
142
162
143
2. Retrieve Tenant and Client information.
163
144
@@ -233,8 +214,10 @@ After activating your account by email, you should have access to your Aure AD i
233
214
234
215
ODM OpenID Liberty configuration needs version 2.0 for the issuerIdentifier. See the [openIdWebSecurity.xml](templates/openIdWebSecurity.xml) file.
235
216
217
+
236
218
It is also necessary to set **acceptMappedClaims** to true to manage claims. Without this setting, you get the exception **AADSTS50146: This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid.** when requesting a token.
237
219
220
+
238
221
Then, click Save.
239
222
240
223
8. Check the configuration.
@@ -426,7 +409,7 @@ After activating your account by email, you should have access to your Aure AD i
426
409
427
410
```shell
428
411
helm search repo ibm-odm-prod
429
-
NAME CHART VERSION APP VERSION DESCRIPTION
412
+
NAME CHART VERSION APP VERSION DESCRIPTION
430
413
ibm-helm/ibm-odm-prod 23.1.0 8.12.0.0 IBM Operational Decision Manager
431
414
```
432
415
@@ -435,9 +418,9 @@ After activating your account by email, you should have access to your Aure AD i
435
418
You can now install the product. We will use the PostgreSQL internal database and disable the data persistence (`internalDatabase.persistence.enabled=false`) to avoid any platform complexity concerning persistent volume allocation.
436
419
437
420
#### a. Installation on OpenShift using Routes
438
-
421
+
439
422
See the [Preparing to install](https://www.ibm.com/docs/en/odm/8.12.0?topic=production-preparing-install-operational-decision-manager) documentation for additional information.
Deploy the **Loan Validation Service** production_deployment ruleapps using the **production deployment** deployment configuration in the Deployments>Configurations tab.
0 commit comments